Is there a patch available for CVE-2026-48225?

Yes, a patch is available for CVE-2026-48225. Update the affected software to the latest version immediately.

Open ISES Tickets CVE-2026-48225

Q: What is the CVSS score of CVE-2026-48225?

CVE-2026-48225 has a CVSS 4.0 base score of 5.1 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-31304 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-05-21 VulnCheck

GHSA-wr5p-cr8q-h6f5

PHP XSS

5.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.1 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Source Code Evidence Fetched

May 21, 2026 - 18:38 vuln.today

Analysis Generated

May 21, 2026 - 18:38 vuln.today

CVSS changed

May 21, 2026 - 18:22 NVD

5.4 (MEDIUM) 5.1 (MEDIUM)

DescriptionCVE.org

Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in landb.php that allows authenticated attackers to inject arbitrary JavaScript by passing an unsanitized value through the _type POST parameter directly into an HTML form hidden input value attribute. Attackers can craft a malicious request containing a JavaScript payload that executes in the victim's browser when the response is rendered.

AnalysisAI

Reflected cross-site scripting in Open ISES Tickets before version 3.44.2 allows an attacker to inject arbitrary JavaScript via the unsanitized _type POST parameter in landb.php, which is echoed directly into an HTML form hidden input value attribute without encoding. When a victim renders the crafted response, the injected script executes in their browser context, enabling session hijacking, credential theft, or forced action on behalf of the victim. This CVE is one of 69 XSS vulnerabilities addressed in the v3.44.2 critical security update; no public exploit has been identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

Open ISES Tickets is a PHP-based helpdesk/ticketing application (CPE: cpe:2.3:a:open_ises:tickets:*:*:*:*:*:*:*:*). The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically a reflected XSS pattern: user-supplied input from the _type POST parameter is written into an HTML form hidden input value attribute in landb.php without HTML entity encoding or sanitization. Because POST data can be submitted via a cross-origin form or crafted fetch request, an attacker can cause a victim to submit a request whose response embeds the payload. The vulnerability resides in the same codebase that the v3.44.2 release notes describe as containing 19 SQL injection issues, 5 hardcoded secrets, and insecure SSL validation, indicating systemic secure coding deficits across the application.

RemediationAI

Upgrade to Open ISES Tickets v3.44.2 immediately, as this is a vendor-released patch confirmed by both the GitHub release tag (https://github.com/openises/tickets/releases/tag/v3.44.2) and the underlying fix commit (https://github.com/openises/tickets/commit/ecfeb406a016766cae81c749e14b5145a9f2dbff). For Docker deployments, run 'docker compose pull && docker compose up -d'. For traditional installations, download the zip, extract over the existing install, and run the installer in Upgrade mode. If immediate patching is not possible, restrict access to landb.php via web server configuration (e.g., IP allowlisting) to limit exposure to trusted networks - note this prevents legitimate remote use. A Web Application Firewall rule blocking script tags or event handlers in POST body parameters can reduce risk but should not be treated as a permanent substitute for patching, as WAF bypass techniques are well-documented for XSS payloads. Given that v3.44.2 also patches 19 SQL injection vulnerabilities and removes hardcoded credentials, delaying the upgrade carries compounding risk beyond this single CVE.